Two areas report the same recovery status. In one, the test worked but its record is missing; in the other, a plan exists but the test failed. Distinguish the gaps and record the tasks and dependencies for NIS2 implementation on an action board.
Map measures and records to the NIS2 requirements supplied in the course. Request missing evidence and write an assignment to correct and retest the failed recovery. Check the sequence and deadlines against available specialist capacity, then enter the work in your action board.
Use your own area or a substitute case and take away the completed gap register with tasks and dependencies. Applicability and national implementation require separate specialist review for the intended use.
What you will work on
Define programme boundaries and record the clarification needed on applicability
Record gaps and evidence deficiencies with accountable roles
Distinguish missing implementation from missing evidence and address both
Who it is for
NIS2 programme leaders
Information security managers
Compliance and organisational managers
Topics
EU framework and national implementation
Requirements and evidence mapping
Gap register and ownership
Risk, dependencies and prioritisation
Roadmap and management reporting
Your result
Your action board includes a completed gap register with requirements, evidence, tasks and dependencies. Use it to follow the work through the programme.
Prerequisites
Basic NIS2 knowledge and experience in security or compliance processes. For your own case, you need an organisational area and approved baseline information; alternatively, use a substitute case.
Format and approach
Planned: 8–10 hours of self-study, including register development and self-checks with explanations.
Work through a checklist for cybersecurity reports to your management body. Check which statements are supported by evidence, where information is missing and which follow-up actions are needed. Adapt the checklist to your organisation.
A service fails at 8:00. The cause and scope are still unclear, and the case requires an internal handover by 10:00. Prepare it with confirmed information and open questions, and identify who makes the provisional decision.
Turn findings from an incident, exercise or process failure into practical actions. Record tasks, owners, deadlines and effectiveness checks on an action board. Using your own case or a course case, you examine whether a measure has the intended effect.